OpenNebula

When OpenNebula runs with Haizea as a scheduling backend, if a request is denied or postponed, a user can still override the scheduler by manually running "onevm deploy". This is actually also an issue when running with the default scheduler.

The OpenNebula team has stated that this could be solved by writing an authorization plugin that restricts "deploy" permissions to only oneadmin (which would work with Haizea, since Haizea uses the oneadmin account to deploy VMs). This seems like a big enough gap that OpenNebula should just include such a plugin by default, giving administrators the option to enable it if they want to prevent users from running "onevm deploy" on their own.

Of course, we could think of fancier schemes down the road (where administrators can specify specific privileges and assign them to certain users, or even groups of users, but not to others) but, for now, I believe that just a plugin included with the regular OpenNebula distribution would be enough.